All Apps and Add-ons

Splunk 5.0.1 and Splunk LEA 2.0.1 log grabber

richfoster
Engager

I have an install of splunk 5.0.1 that was using an old lea-loggrabber app. I have installed the new Splunk support LEA grabber for OPSEC and now seem to have issues with my logs not showing anymore. I can see from tcpdump that the logs are being sent to the splunk server, however they do not show in splunk search. Also when trying to perform a search now I get the following errors
"Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'opsec' and lookup table 'checkpoint_action_lookup'.

Tags (1)

krugger
Communicator

It wasn't working for me either.

I solved the problem by rewriting the parsing. This might not be the best solution and it might not work for you, because of diferences in the products. Anyway I hope it helps.

I first renamed the default/props.conf to default/props.bak and default/transforms.conf to default/transforms.bak. Then I created new props.conf nad transforms.conf in the local directory.


props.conf:
[opsec]
SHOULD_LINEMERGE = false
TIME_PREFIX = time=
TIME_FORMAT = %d%b%Y %H:%M:%S
REPORT-opsec = opsec
REPORT-opsec-message = opsec-message

transforms.conf:
[opsec]
REGEX = loc=\d+ filename=\S+ fileid=\d+ time=.\S+ \S+ action=(\S+) orig=(\S+) i\/f_dir=(\S+) i\/f_name=(\S+) has_accounting=\S+ product=(.) __policy_id_tag=.( rule=\d+)?( rule_uid=\S+)?( rule_name=.)?( service_id=\S+)? src=(\S+) s_port=(\S+) dst=(\S+) service=(\S+) proto=(\S+)( message_info=.)?( xlatesrc=\S+ xlatesport=\S+)?( xlatedport=\S+)?( NAT_rulenum=\d+)?( NAT_addtnl_rulenum=\d+)?
FORMAT = action::$1 orig::$2 if_dir::$3 if_name::$4 product::$5 src::$6 s_port::$7 dst::$8 service::$9 proto::$10

[opsec-message]
REGEX = proto=\S+ message_info=(.*)( xlatesrc=\S+ xlatesport=\S+)?( xlatedport=\S+)?
FORMAT = message::$1

araitz
Splunk Employee
Splunk Employee

I have filed OPSEC-95 and will attempt to reproduce.

UPDATE: I can reproduce the knowledge issues (i.e. the lookup table error). I am still working to reproduce the other knowledge issues.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...